# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 63 → 31 (-31.4)
- Rubric changed (rubric-2026.08.18 → rubric-2026.08.15) — scores are not directly comparable.

## Lenses

- Code Health 78 → 92 (+13.7)
- Architecture 96 → 94 (-1.8)
- Maturity 53 → 51 (-2.1)
- Readiness 63 → 28 (-34.8)
- Security 67 → 42 (-25.2)
- Domain Modelling 100 → 19 (-81.4)

## Resolved (77)

- ApConfigurationScreenKt.ApConfigurationScreen (cognitive 71) (mobile/src/main/java/be/mygod/vpnhotspot/ui/apconfiguration/ApConfigurationScreen.kt)
- ApConfigurationScreenKt.ApConfigurationScreen (cyclomatic 56) (mobile/src/main/java/be/mygod/vpnhotspot/ui/apconfiguration/ApConfigurationScreen.kt)
- ApConfigurationSessionKt.applySystemApConfiguration (cognitive 34) (mobile/src/main/java/be/mygod/vpnhotspot/ui/apconfiguration/ApConfigurationSession.kt)
- ApConfigurationState.generateConfigError (cognitive 31) (mobile/src/main/java/be/mygod/vpnhotspot/ui/apconfiguration/ApConfigurationState.kt)
- ApConfigurationState.generateConfigError (cyclomatic 23) (mobile/src/main/java/be/mygod/vpnhotspot/ui/apconfiguration/ApConfigurationState.kt)
- App.attachBaseContext (cognitive 21) (mobile/src/main/java/be/mygod/vpnhotspot/App.kt)
- App.attachBaseContext (cyclomatic 16) (mobile/src/main/java/be/mygod/vpnhotspot/App.kt)
- Change coupling: Converters.kt ↔ Utils.kt (mobile/src/main/java/be/mygod/vpnhotspot/room/Converters.kt)
- Change coupling: DaemonController.kt ↔ main.rs (mobile/src/main/java/be/mygod/vpnhotspot/root/daemon/DaemonController.kt)
- Change coupling: DaemonController.kt ↔ neighbour.rs (mobile/src/main/java/be/mygod/vpnhotspot/root/daemon/DaemonController.kt)
- Change coupling: DaemonController.kt ↔ netlink.rs (mobile/src/main/java/be/mygod/vpnhotspot/root/daemon/DaemonController.kt)
- Change coupling: NetlinkNeighbourMonitoringService.kt ↔ NetlinkNeighbourMonitoringTileService.kt (mobile/src/main/java/be/mygod/vpnhotspot/NetlinkNeighbourMonitoringService.kt)
- Change coupling: RepeaterService.kt ↔ WifiP2pManagerHelper.kt (mobile/src/main/java/be/mygod/vpnhotspot/RepeaterService.kt)
- Change coupling: Routing.kt ↔ protocol.rs (mobile/src/main/java/be/mygod/vpnhotspot/net/Routing.kt)
- Change coupling: dns.rs ↔ upstream.rs (mobile/src/main/rust/vpnhotspotd/src/dns.rs)
- Change coupling: neighbour.rs ↔ routing.rs (mobile/src/main/rust/vpnhotspotd/src/neighbour.rs)
- Change coupling: netlink.rs ↔ protocol.rs (mobile/src/main/rust/vpnhotspotd/src/netlink.rs)
- ClientViewModel.populateClients (cognitive 33) (mobile/src/main/java/be/mygod/vpnhotspot/client/ClientViewModel.kt)
- ClientViewModel.populateClients (cyclomatic 21) (mobile/src/main/java/be/mygod/vpnhotspot/client/ClientViewModel.kt)
- ClientsScreenKt.ClientRow (cyclomatic 20) (mobile/src/main/java/be/mygod/vpnhotspot/ui/ClientsScreen.kt)
- …and 57 more

## New (7)

- Coverage not measured — test suite did not build
- Dimension evaluation failed
- High: security finding (details withheld)
- Leaked secret: gcp-api-key (mobile/google-services.json)
- No tests found
- Secret: generic-api-key (mobile/src/main/rust/vpnhotspotd/src/shared/ipv4_forward_counter.rs)
- The 'Features That Requires System App Installation' section lists features but does not state which of them actually require a system app (e.g. the recommended use with a real VPN/socksifier) and how to verify it. (README.md)

## Changes since last survey

- 17 commits — 13 feature/other, 4 fixes

## By area

- mobile/src — 15 commits
- (root) — 1 commit
- docs/vpnhotspotd — 1 commit

## Notable commits

- fix: Fix channel selection for p2p
- fix: Fix launch from tile service
- fix: Fix quoted-packet parsing
- fix: Fix root process exit handler
- change: Atomic boot config
- change: Better ensure chain
- change: Capture service internal error code
- change: Gate OWE to API 33
- change: Gate repeater service creation
- change: Handle p2p interface unavailable for incompatible mode
- change: Handle unknown p2p security types
- change: Predictive back fancy animation
- change: Single-delete probe rules
- change: Suppress incompatible mode path 2
- change: Suppress unsupported mac randomization setting
- change: Track stackless stack
- change: v3.0.8

## Architecture

- Containers 0 added · 0 removed · contexts 0 added · 1 removed · edges 0 added · 0 removed

## Removed bounded contexts (1)

- mobile